On Mon, 12 Feb 2024 20:23:27 GMT, Daniel Jeliński <djelin...@openjdk.org> wrote:
> Currently the SunPKCS11 provider requires other providers in order to offer > ECDHE, FFDHE and RSA-PSS in TLS handshakes: > - FFDHE requires DiffieHellman AlgorithmParameters from SunJCE > - ECDHE requires the SunEC provider to be installed > - RSA-PSS requires RSASSA-PSS AlgorithmParameters from SunRsaSign > > This PR removes these dependencies: > - SunPKCS11 is modified to offer the PSS and DH AlgorithmParameters (using > the same implementation classes as the original providers) > - Elliptic curve code is modified to remove the dependency on SunEC provider > where possible > > Two existing tests were modified to verify the changes: > - SigInteropPSS2 test was modified to install SunPKCS11 provider and remove > SunRsaSign provider > - FipsModeTLS12 test was modified to verify the list of NamedGroups available > on a SSLEngine. > > Both modified tests fail without the changes, pass with them. Other tier1-3 > tests continue to pass. This pull request has now been integrated. Changeset: 8f9899b2 Author: Daniel Jeliński <djelin...@openjdk.org> URL: https://git.openjdk.org/jdk/commit/8f9899b23ee46ad986bc719d3e2eec722d8d6bf8 Stats: 96 lines in 10 files changed: 29 ins; 30 del; 37 mod 8325164: Named groups and signature schemes unavailable with SunPKCS11 in FIPS mode Reviewed-by: valeriep ------------- PR: https://git.openjdk.org/jdk/pull/17816
